组织的存储库角色
你可以通过分配角色，为组织成员、外部协作者和人员团队提供对组织仓库不同级别的权限。 选择最适合每个人或团队在项目中的职能的角色，而不是提供超过其需求的项目权限。
组织存储库的角色从低到高的权限级别分别为：
- 读取： 建议分配给需要查看或讨论项目的非代码参与者
- 分类： 推荐给需要主动管理问题、讨论和拉取请求但无写入权限的参与者
- 写入： 建议分配给积极向项目推送内容的参与者
- 维护： 建议分配给需要在没有敏感或破坏性操作权限的情况下管理存储库的项目管理员
- 管理： 建议分配给需要完全访问项目的人，包括管理安全性或删除存储库等敏感和破坏性操作
可以创建自定义存储库角色。 有关详细信息，请参阅“管理组织的自定义存储库角色”。
组织所有者可以在访问组织的任何仓库时设置适用于组织所有成员的基本权限。 有关详细信息，请参阅“为组织设置基本权限”。
组织所有者还可以选择进一步限制对整个组织中某些设置和操作的权限。 有关特定设置选项的详细信息，请参阅 管理组织设置。
除了管理组织级设置之外，组织所有者对组织拥有的每个存储库都具有管理员权限。 有关详细信息，请参阅“组织中的角色”。
警告
当有人向存储库添加部署密钥时，拥有私钥的任何用户都可以读取或写入存储库（具体取决于密钥设置），即使他们后来从组织中删除也是如此。
每个角色的权限
注意
下面的安全功能的访问要求中列出了使用安全功能所需的角色。
| 仓库操作 | 读取 | 会审 | 写入 | 维护 | 管理员 |
|---|
| Manage individual, team, and outside collaborator access to the repository
| ✗ |
| Pull from the person or team's assigned repositories
| ✗ |
| Fork the person or team's assigned repositories
| ✗ |
| Edit and delete their own comments
| ✗ |
| Open issues
| ✗ |
| Close issues they opened themselves
| ✗ |
| Reopen issues they closed themselves
| ✗ |
| Have an issue assigned to them
| ✗ |
| Send pull requests from forks of the team's assigned repositories
| ✗ |
| Submit reviews on pull requests
| ✗ |
| Approve or request changes to a pull request with required reviews
| ✗ |
| Apply suggested changes to pull requests
| ✗ |
| View published releases
| ✗ |
| View GitHub Actions workflow runs
| ✗ |
| Edit wikis in public repositories
| ✗ |
| Edit wikis in private repositories
| ✗ |
| Report abusive or spammy content
| ✗ |
| Apply/dismiss labels
| ✗ |
| Create, edit, delete labels
| ✗ |
| Close, reopen, and assign all issues and pull requests
| ✗ |
| Enable and disable auto-merge on a pull request
| ✗ |
| Create, edit, delete milestones
| ✗ |
| Apply milestones
| ✗ |
| Mark duplicate issues and pull requests
| ✗ |
| Request pull request reviews
| ✗ |
| Merge a pull request
| ✗ |
| Push to (write) the person or team's assigned repositories
| ✗ |
| Edit and delete anyone's comments on commits, pull requests, and issues
| ✗ |
| Hide anyone's comments on discussions
| ✗ |
| Hide anyone's comments on issues, pull requests, and commits
| ✗ |
| ✗ |
| Transfer issues (see 将问题转移到其他仓库 for details)
| ✗ |
| Act as a designated code owner for a repository
| ✗ |
| Mark a draft pull request as ready for review
| ✗ |
| Convert a pull request to a draft
| ✗ |
| Create status checks
| ✗ |
| Create, edit, run, re-run, and cancel GitHub Actions workflows
| ✗ |
| Create, update, and delete GitHub Actions secrets on GitHub.com
| ✗ |
| Create, update, and delete GitHub Actions secrets using the REST API
| ✗ |
| Create, update, and delete GitHub Actions variables on GitHub.com
| ✗ |
| Create, update, and delete GitHub Actions variables using the REST API
| ✗ |
| Create and edit releases
| ✗ |
| View draft releases
| ✗ |
| Edit a repository's description
| ✗ |
| ✗ |
| ✗ |
| ✗ |
| Manage topics
| ✗ |
| Enable wikis and restrict wiki editors
| ✗ |
| Configure pull request merges
| ✗ |
| Configure a publishing source for GitHub Pages
| ✗ |
| View content exclusion settings for GitHub Copilot
| ✗ |
| Manage branch protection rules and repository rulesets
| ✗ |
| View rulesets for a repository
| ✗ |
|
Push to protected branches
Doesn't apply to rulesets as these have a different bypass model. See Granting bypass permissions for your branch or tag ruleset.
| ✗ |
| Merge pull requests on protected branches, even if there are no approving reviews
| ✗ |
| Create and edit repository social cards
| ✗ |
| Limit interactions in a repository
| ✗ |
| Delete an issue (see 删除议题)
| ✗ |
| Define code owners for a repository
| ✗ |
| Add a repository to a team (see 管理团队对组织存储库的访问 for details)
| ✗ |
| Manage outside collaborator access to a repository
| ✗ |
| Change a repository's visibility
| ✗ |
| Make a repository a template (see 创建模板仓库)
| ✗ |
| Change a repository's settings
| ✗ |
| Manage team and collaborator access to the repository
| ✗ |
| Edit the repository's default branch
| ✗ |
| Rename the repository's default branch (see 重命名分支)
| ✗ |
| Rename a branch other than the repository's default branch (see 重命名分支)
| ✗ |
| Manage webhooks and deploy keys
| ✗ |
| Manage the forking policy for a repository
| ✗ |
| Transfer repositories into the organization
| ✗ |
| Delete or transfer repositories out of the organization
| ✗ |
| ✗ |
| Display a sponsor button (see 在代码库中显示赞助按钮)
| ✗ |
| Create autolink references to external resources, like Jira or Zendesk (see 配置自动链接以引用外部资源)
| ✗ |
| Enable GitHub Discussions in a repository
| ✗ |
| Create and edit categories for GitHub Discussions
| ✗ |
| Move a discussion to a different category
| ✗ |
| Transfer a discussion to a new repository
| ✗ |
| ✗ |
| ✗ |
| Individually convert issues to discussions
| ✗ |
| Create new discussions and comment on existing discussions
| ✗ |
| ✗ |
| Create codespaces for private/internal repositories
| ✗ |
| Create codespaces for private/internal repositories with Codespaces secrets access
| ✗ |
|
Create codespaces for public repositories
(users with read-only access can only create codespaces at their own expense)
| ✗ |
| Edit the custom property values for the repository
| ✗ |
安全功能的访问要求
在本部分中，可以找到安全功能（如 GitHub Advanced Security 功能）所需的访问权限。
注意
存储库作者和维护者只能直接查看他们自己提交的机密扫描警报信息。 他们无法访问警报列表视图。
| 仓库操作 | 读取 | 会审 | 写入 | 维护 | 管理员 |
|---|
| Receive Dependabot alerts for insecure dependencies in a repository
| ✗ |
| ✗ |
| Designate additional people or teams to receive security alerts
| ✗ |
| Create security advisories
| ✗ |
| Manage access to GitHub Advanced Security features (see 管理组织的安全和分析设置)
| ✗ |
| Enable the dependency graph for a private repository
| ✗ |
| ✗ |
| View code scanning alerts on pull requests
| ✗ |
| List, dismiss, and delete code scanning alerts
| ✗ |
| View and dismiss 机密扫描警报 in a repository
| ✗ |
| Resolve, revoke, or re-open 机密扫描警报
| ✗ |
| Designate additional people or teams to receive 机密扫描警报 in repositories
| ✗ |